The WowPress plugin for WordPress contains a stored cross‑site scripting flaw in its wowpress shortcode. Because the plugin fails to properly sanitize and escape attributes supplied by users, an attacker who can create or edit content with contributor-level access or higher can embed arbitrary JavaScript into a shortcode. When other users view pages that contain the maliciously altered shortcode, the injected script is executed in their browsers, allowing attackers to steal credentials, hijack sessions, or deface content. The weakness is identified as CWE‑79, reflecting a classic input validation error.

All releases of the WowPress plugin from the vendor theyeti up to and including version 1.0.0 are affected. WordPress sites that incorporate the wowpress shortcode in any of these versions are at risk.

The base score of 6.4 indicates moderate severity. No external exploitation probability data is available, suggesting a medium likelihood of attack. The vulnerability is not listed in the known exploited vulnerabilities catalog, but because it can execute arbitrary code in users’ browsers, the risk remains significant for sites that allow contributors or higher roles to edit content containing the shortcode. Attacks would require authenticated access that grants the ability to add or modify the shortcode attributes.